Android.Packed.43649

Техническая информация

Вредоносные функции:

Выполняет код следующих детектируемых угроз:

Android.DownLoader.455.origin

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) at####.zh####.com.####.com:80
TCP(HTTP/1.1) bbs.a####.com:80
TCP(HTTP/1.1) ping####.qq.com:80
TCP(HTTP/1.1) pv.a####.com:80
TCP(HTTP/1.1) hm.b####.com:80
TCP(HTTP/1.1) t####.qq.com:80
TCP(TLS/1.0) 2####.58.212.174:443
TCP(TLS/1.0) s####.g.doublec####.net:443
TCP(TLS/1.0) t####.qq.com:443
TCP(TLS/1.0) and####.cli####.go####.com:443
TCP p1.zxl####.com:9802
TCP p1.zxl####.com:9803
TCP p1.zxl####.com:9801

Запросы DNS:

and####.cli####.go####.com
at####.zh####.com
bbs.a####.com
bbs.zh####.com
fd.a####.com
hm.b####.com
mt####.go####.com
p1.zxl####.com
p2.zxl####.com
p3.zxl####.com
ping####.qq.com
pv.a####.com
s####.g.doublec####.net
t####.qq.com
www.google-####.com

Запросы HTTP GET:

at####.zh####.com.####.com/common/01/common_1329_icon_720385.png
at####.zh####.com.####.com/common/01/common_2045_icon_600312.png
at####.zh####.com.####.com/common/01/common_2113_icon_202880.png
at####.zh####.com.####.com/common/02/common_2121_icon_452664.jpg
at####.zh####.com.####.com/common/02/common_2176_icon_786407.png
at####.zh####.com.####.com/common/05/common_1895_icon_269155.png
at####.zh####.com.####.com/common/06/common_126_icon_381179.png
at####.zh####.com.####.com/common/06/common_1997_icon_435176.png
at####.zh####.com.####.com/common/08/common_2000_icon_629468.png
at####.zh####.com.####.com/common/0a/common_1455_icon_305654.png
at####.zh####.com.####.com/common/0a/common_191_icon_720837.png
at####.zh####.com.####.com/common/0b/common_2091_icon_756510.png
at####.zh####.com.####.com/common/0e/common_1183_icon_599481.png
at####.zh####.com.####.com/common/0e/common_1594_icon_594525.png
at####.zh####.com.####.com/common/0e/common_1715_icon_004811.png
at####.zh####.com.####.com/common/10/common_1528_icon_379053.png
at####.zh####.com.####.com/common/10/common_2181_icon_877591.png
at####.zh####.com.####.com/common/13/common_1937_icon_204718.png
at####.zh####.com.####.com/common/18/common_2160_icon_603510.png
at####.zh####.com.####.com/common/1a/common_2111_icon_510306.png
at####.zh####.com.####.com/common/1b/common_1984_icon_083434.jpg
at####.zh####.com.####.com/common/1b/common_2119_icon_727060.png
at####.zh####.com.####.com/common/1c/common_2189_icon_410401.jpg
at####.zh####.com.####.com/common/1c/common_35_icon_380667.png
at####.zh####.com.####.com/common/1e/common_850_icon_600833.png
at####.zh####.com.####.com/common/20/common_1547_icon_678638.png
at####.zh####.com.####.com/common/21/common_2175_icon_786425.png
at####.zh####.com.####.com/common/24/common_2105_icon_731903.png
at####.zh####.com.####.com/common/24/common_2150_icon_173963.png
at####.zh####.com.####.com/common/24/common_372_icon_380731.png
at####.zh####.com.####.com/common/2a/common_2142_icon_513565.png
at####.zh####.com.####.com/common/2b/common_2035_icon_731236.png
at####.zh####.com.####.com/common/2c/common_2095_icon_458202.png
at####.zh####.com.####.com/common/2d/common_1449_icon_381421.png
at####.zh####.com.####.com/common/2f/common_1168_icon_678586.png
at####.zh####.com.####.com/common/30/common_1418_icon_224523.jpg
at####.zh####.com.####.com/common/31/common_2025_icon_667466.png
at####.zh####.com.####.com/common/32/common_2166_icon_312495.png
at####.zh####.com.####.com/common/33/common_2161_icon_605312.png
at####.zh####.com.####.com/common/33/common_28_icon_916890.png
at####.zh####.com.####.com/common/35/common_1390_icon_892604.jpg
at####.zh####.com.####.com/common/37/common_2139_icon_511998.png
at####.zh####.com.####.com/common/39/common_137_icon_671817.png
at####.zh####.com.####.com/common/39/common_1808_icon_307437.png
at####.zh####.com.####.com/common/3a/common_2180_icon_877583.png
at####.zh####.com.####.com/common/41/common_2168_icon_548324.png
at####.zh####.com.####.com/common/42/common_1470_icon_608273.png
at####.zh####.com.####.com/common/44/common_1879_icon_877554.png
at####.zh####.com.####.com/common/44/common_2120_icon_736062.png
at####.zh####.com.####.com/common/4b/common_2073_icon_717665.png
at####.zh####.com.####.com/common/4b/common_2116_icon_824582.png
at####.zh####.com.####.com/common/4d/common_2087_icon_889624.jpg
at####.zh####.com.####.com/common/4e/common_1403_icon_121141.png
at####.zh####.com.####.com/common/50/common_1314_icon_379428.png
at####.zh####.com.####.com/common/51/common_2114_icon_278913.png
at####.zh####.com.####.com/common/52/common_1637_icon_564406.png
at####.zh####.com.####.com/common/53/common_1453_icon_571004.png
at####.zh####.com.####.com/common/58/common_2052_icon_029983.png
at####.zh####.com.####.com/common/58/common_948_icon_381275.png
at####.zh####.com.####.com/common/59/common_1794_icon_457133.png
at####.zh####.com.####.com/common/5c/common_1384_icon_720504.png
at####.zh####.com.####.com/common/5d/common_2141_icon_441602.png
at####.zh####.com.####.com/common/63/common_1996_icon_027521.png
at####.zh####.com.####.com/common/65/common_1020_icon_380022.png
at####.zh####.com.####.com/common/65/common_105_icon_671556.png
at####.zh####.com.####.com/common/65/common_11_icon_600287.png
at####.zh####.com.####.com/common/65/common_1916_icon_159236.png
at####.zh####.com.####.com/common/65/common_2015_icon_192787.png
at####.zh####.com.####.com/common/65/common_2079_icon_486726.png
at####.zh####.com.####.com/common/67/common_1452_icon_570858.png
at####.zh####.com.####.com/common/67/common_811_icon_671341.png
at####.zh####.com.####.com/common/6e/common_2163_icon_868747.png
at####.zh####.com.####.com/common/74/common_1726_icon_343902.png
at####.zh####.com.####.com/common/7b/common_2103_icon_706459.png
at####.zh####.com.####.com/common/7b/common_2173_icon_878100.png
at####.zh####.com.####.com/common/7d/common_2144_icon_440919.png
at####.zh####.com.####.com/common/7e/common_1875_icon_347240.png
at####.zh####.com.####.com/common/7f/common_1485_icon_916132.png
at####.zh####.com.####.com/common/7f/common_1687_icon_196541.png
at####.zh####.com.####.com/common/81/common_2186_icon_409454.png
at####.zh####.com.####.com/common/81/common_812_icon_671616.png
at####.zh####.com.####.com/common/83/common_1514_icon_564381.png
at####.zh####.com.####.com/common/85/common_1837_icon_940593.jpg
at####.zh####.com.####.com/common/86/common_1345_icon_678440.png
at####.zh####.com.####.com/common/86/common_1385_icon_720401.png
at####.zh####.com.####.com/common/88/common_2170_icon_786181.png
at####.zh####.com.####.com/common/89/common_1644_icon_595046.png
at####.zh####.com.####.com/common/89/common_2165_icon_793647.png
at####.zh####.com.####.com/common/8b/common_1352_icon_324182.jpg
at####.zh####.com.####.com/common/8d/common_1647_icon_714959.png
at####.zh####.com.####.com/common/8f/common_1446_icon_381310.png
at####.zh####.com.####.com/common/90/common_1796_icon_687512.png
at####.zh####.com.####.com/common/92/common_2118_icon_015890.png
at####.zh####.com.####.com/common/93/common_2108_icon_813034.jpg
at####.zh####.com.####.com/common/93/common_2146_icon_440660.png
at####.zh####.com.####.com/common/96/common_1363_icon_720365.png
at####.zh####.com.####.com/common/98/common_1968_icon_671155.png
at####.zh####.com.####.com/common/99/common_1531_icon_069386.png
at####.zh####.com.####.com/common/99/common_2172_icon_878090.png
at####.zh####.com.####.com/common/9a/common_1833_icon_720498.png
at####.zh####.com.####.com/common/9a/common_2055_icon_321145.png
at####.zh####.com.####.com/common/9a/common_2135_icon_577161.png
at####.zh####.com.####.com/common/9b/common_2137_icon_442032.png
at####.zh####.com.####.com/common/9d/common_1654_icon_720416.png
at####.zh####.com.####.com/common/9f/common_2143_icon_439482.png
at####.zh####.com.####.com/common/a0/common_1308_icon_433163.png
at####.zh####.com.####.com/common/a0/common_2084_icon_443874.png
at####.zh####.com.####.com/common/a2/common_2112_icon_943972.png
at####.zh####.com.####.com/common/a3/common_2155_icon_157372.png
at####.zh####.com.####.com/common/a4/common_2152_icon_151849.png
at####.zh####.com.####.com/common/a5/common_2033_icon_600798.png
at####.zh####.com.####.com/common/a5/common_37_icon_599454.png
at####.zh####.com.####.com/common/a5/common_38_icon_917039.jpg
at####.zh####.com.####.com/common/a8/common_2131_icon_513256.png
at####.zh####.com.####.com/common/a9/common_107_icon_145734.png
at####.zh####.com.####.com/common/a9/common_1711_icon_756528.png
at####.zh####.com.####.com/common/aa/common_1529_icon_069502.jpg
at####.zh####.com.####.com/common/ab/common_1910_icon_376467.png
at####.zh####.com.####.com/common/ac/common_99_icon_380717.png
at####.zh####.com.####.com/common/af/common_1546_icon_678621.png
at####.zh####.com.####.com/common/af/common_1897_icon_285502.png
at####.zh####.com.####.com/common/b1/common_1441_icon_678484.png
at####.zh####.com.####.com/common/b2/common_1445_icon_381365.png
at####.zh####.com.####.com/common/b4/common_1915_icon_093825.png
at####.zh####.com.####.com/common/b4/common_2188_icon_408630.jpg
at####.zh####.com.####.com/common/b5/common_2067_icon_352246.png
at####.zh####.com.####.com/common/b6/common_22_icon_560029.png
at####.zh####.com.####.com/common/ba/common_1379_icon_378465.png
at####.zh####.com.####.com/common/ba/common_1876_icon_720410.png
at####.zh####.com.####.com/common/bb/common_1324_icon_720373.png
at####.zh####.com.####.com/common/bd/common_2169_icon_786123.png
at####.zh####.com.####.com/common/bf/common_1483_icon_689716.png
at####.zh####.com.####.com/common/bf/common_1791_icon_416699.png
at####.zh####.com.####.com/common/bf/common_2089_icon_682027.png
at####.zh####.com.####.com/common/c4/common_1972_icon_799182.png
at####.zh####.com.####.com/common/c5/common_1998_icon_771672.png
at####.zh####.com.####.com/common/c5/common_2101_icon_067516.png
at####.zh####.com.####.com/common/c8/common_2_icon_380683.png
at####.zh####.com.####.com/common/c9/common_2133_icon_442209.png
at####.zh####.com.####.com/common/cb/common_1530_icon_069447.png
at####.zh####.com.####.com/common/cb/common_2075_icon_718591.png
at####.zh####.com.####.com/common/cb/common_2153_icon_152122.png
at####.zh####.com.####.com/common/cd/common_1540_icon_250041.png
at####.zh####.com.####.com/common/cf/common_1500_icon_981888.png
at####.zh####.com.####.com/common/d1/common_1339_icon_678672.png
at####.zh####.com.####.com/common/d1/common_1806_icon_307153.png
at####.zh####.com.####.com/common/d3/common_10_icon_600269.png
at####.zh####.com.####.com/common/d3/common_1238_icon_678601.png
at####.zh####.com.####.com/common/d3/common_2088_icon_992488.png
at####.zh####.com.####.com/common/d5/common_2182_icon_266767.png
at####.zh####.com.####.com/common/d7/common_1834_icon_434162.png
at####.zh####.com.####.com/common/d9/common_1398_icon_391737.png
at####.zh####.com.####.com/common/dc/common_1262_icon_720392.png
at####.zh####.com.####.com/common/dc/common_1322_icon_720493.png
at####.zh####.com.####.com/common/dd/common_1976_icon_373883.png
at####.zh####.com.####.com/common/df/common_1835_icon_914558.jpg
at####.zh####.com.####.com/common/e1/common_1115_icon_809791.png
at####.zh####.com.####.com/common/e1/common_1882_icon_564450.png
at####.zh####.com.####.com/common/e2/common_2148_icon_958314.png
at####.zh####.com.####.com/common/e2/common_2187_icon_409863.jpg
at####.zh####.com.####.com/common/e7/common_716_icon_414323.png
at####.zh####.com.####.com/common/e8/common_1480_icon_813997.png
at####.zh####.com.####.com/common/e9/common_1448_icon_381451.png
at####.zh####.com.####.com/common/eb/common_1511_icon_614241.png
at####.zh####.com.####.com/common/ed/common_98_icon_380701.png
at####.zh####.com.####.com/common/ef/common_2124_icon_512833.png
at####.zh####.com.####.com/common/f0/common_1774_icon_368169.png
at####.zh####.com.####.com/common/f2/common_324_icon_380651.png
at####.zh####.com.####.com/common/f3/common_1800_icon_720379.png
at####.zh####.com.####.com/common/f6/common_1442_icon_678464.png
at####.zh####.com.####.com/common/f8/common_2086_icon_889509.jpg
at####.zh####.com.####.com/common/f8/common_2171_icon_786355.png
at####.zh####.com.####.com/common/fa/common_1816_icon_324805.png
at####.zh####.com.####.com/common/fb/common_1360_icon_599505.png
at####.zh####.com.####.com/common/fb/common_1871_icon_738777.png
at####.zh####.com.####.com/common/fc/common_2134_icon_439699.png
at####.zh####.com.####.com/common/ff/common_1333_icon_288193.png
bbs.a####.com/
bbs.a####.com//mplus/img/apple-touch-icon-114x114.png
bbs.a####.com/favicon.ico
bbs.a####.com/forum.php?mod=####
bbs.a####.com/mplus/comfooter.css?D####
bbs.a####.com/mplus/common.css
bbs.a####.com/mplus/ecommon.css?v####
bbs.a####.com/mplus/forum.css
bbs.a####.com/mplus/game_wap.css?v####
bbs.a####.com/mplus/images/close_btn.png
bbs.a####.com/mplus/images/enterad/tips_01.png
bbs.a####.com/mplus/images/enterad/tips_colse.png
bbs.a####.com/mplus/images/enterad/tips_down.png
bbs.a####.com/mplus/images/footer_bg.png
bbs.a####.com/mplus/images/zhiyoo_logo.png
bbs.a####.com/mplus/img/c_nm.png
bbs.a####.com/mplus/img/h_s.png
bbs.a####.com/mplus/img/h_t.png
bbs.a####.com/mplus/img/h_u.png
bbs.a####.com/mplus/img/hd.png
bbs.a####.com/mplus/img/logo.png
bbs.a####.com/mplus/img/o.png
bbs.a####.com/mplus/img/share_notice2.png
bbs.a####.com/mplus/js/common.js?z####
bbs.a####.com/mplus/js/toggle.js
bbs.a####.com/mplus/portal.css
bbs.a####.com/mplus/style.css?D####
bbs.a####.com/static/js/common.js?z####
bbs.a####.com/static/js/forum.js?z####
bbs.a####.com/static/js/zhiyoo_scheme.js?zS8c####
bbs.a####.com/static/js/zhiyootrack.js?z####
bbs.a####.com/static/js/zhiyootrack.js?zS####
hm.b####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&vl=####&et=####&ja=#...
hm.b####.com/hm.gif?si=####&et=####&nv=####&st=####&lt=####&v=####&rnd=#...
hm.b####.com/hm.js?dbd51af####
ping####.qq.com/pingd?dm=####&pvi=####&si=####&url=####&arg=mod####&ty=#...
pv.a####.com/index.html?page=####&mobile=####
pv.a####.com/tjinfo.php?URL=http://bbs.zhiyoo.com/forum.php?mod=####&ACT...
t####.qq.com/stats?sId=####

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/1553310925678p.jar
/data/data/####/fconf_pre.xml
/data/data/####/fp_download.db-journal
/data/data/####/org.nattou.www.layerpaint.LayerPaint.xml
/data/data/####/org.nattou.www.layerpaintyvoRE_preferences.xml
/data/media/####/tmp_save.psd

Другие:

Загружает динамические библиотеки:

layerpaint-jni
z

Получает информацию о сети.

Получает информацию о телефоне (номер, IMEI и т. д.).

Получает информацию об установленных приложениях.

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней